The module currently relies on KernelEvents::RESPONSE to allow/deny access to a page. This event fires very late in the request handling and allows other code to be executed.
Additionally, instead of directly sending the redirect response we should set this to the event in $event->setResponse.
Our setup/usecase is the following:
Adjust Drupal\protected_pages\EventSubscriber\ProtectedPagesSubscriber to rely on KernelEvents::REQUEST so we can return early and use $event->setResponse to set the response.
Needs work
1.0
Code
Not all content is available!
It's likely this issue predates Contrib.social: some issue and comment data are missing.
I created a new merge request because the patch was not applicable anymore to any version of the module after 8.14.x.
This merge request attempts to make it work again. The update was needed because of a recent security vulnerability of the module.